It would be better to use bcrypt, beause its more secure as it's slower (uses more computing cycles).
Your code could also be better:

You wouldn't need salt field in User model, because it's saved into the same field as password does.

For authentication, something like:

var mongoose = require('mongoose'),
  bcrypt = require('bcryptjs');

var userSchema = mongoose.Schema({
  email: String,

Any refrence on how to enable swagger documentation on the express routes ?

See: https://gist.github.com/ericelliott/f3c2a53a1d4100539f71

Advantages

See: https://medium.com/javascript-scene/you-might-not-need-typescript-or-static-types-aa7cb670a77b

• autocomplete and type inference with most IDEs
• doesn't require passing Log objects for every call (although it's encouraged)
• other non-required parameters (such as query) can be omitted
• much easier to a